# Extract MSG files with keyword hits

**URL:** <https://sleuthkit.discourse.group/t/extract-msg-files-with-keyword-hits/280>\
**Category:** Autopsy Feature Requests\
**Created:** [September 21, 2019, 2:55am UTC](https://sleuthkit.discourse.group/t/extract-msg-files-with-keyword-hits/280 "2019-09-21T02:55:34Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![klllmmm](https://avatars.discourse-cdn.com/v4/letter/k/e95f7d/32.png) [@klllmmm](https://sleuthkit.discourse.group/u/klllmmm)\
**Post date:** [September 21, 2019, 2:55am UTC](https://sleuthkit.discourse.group/t/extract-msg-files-with-keyword-hits/280/1 "2019-09-21T02:55:34Z")

</div>

1. I would like to extract the email message (msg) files with the keyword hits.  
Currently, we have to extract the entire OST/PST file and then find out particular email by loading it to email software.  
Appreciate if this feature can be considered.  

2. When extracting some file, please ensure not to change any of the file metadata, example last modified date/time is usually changed to extracted date/time.

---

<div class="post-metadata">

**Author:** ![mandelbrot](https://yyz2.discourse-cdn.com/free1/user_avatar/sleuthkit.discourse.group/mandelbrot/32/107_2.png) [@mandelbrot](https://sleuthkit.discourse.group/u/mandelbrot)\
**Post date:** [November 17, 2019, 5:38pm UTC](https://sleuthkit.discourse.group/t/extract-msg-files-with-keyword-hits/280/2 "2019-11-17T17:38:43Z")

</div>

Hi,  
I’ve a similar scenario with Thunderbird MBOX examination (using email-parser and keyword search ingestion tools)

At the end of the ingestion process i select a keyword hit but I can only easily identify the MBOX that “holds” the specific keyword.

Is there a way also to jump directly to the email message (plaintext + attached files) “holding” the specific keyword ?

Using “View file in Directory” jumps only to the MBOX containter (with many e-mail inside…)

P.S : I’m using Windows Autopsy V4.13

Thanks